Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: fireplugins Clear all filters
TI-2026-70249 CVE-2026-104724 · GHSA-8cc4-h37g-8v64

SQL injection in FireBox popup builder via form display condition

Priority LOW 24

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and includi…

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00236 Published 2026-10-10 No fix listed CWE-89
TI-2026-53658 CVE-2026-76801 · GHSA-48j6-7xh6-vcfv

FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation

Priority MEDIUM 42

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00939 Published 2026-09-09 No fix listed CWE-269
TI-2025-41299 CVE-2025-67545 · GHSA-3662-gvg6-j9xx

WordPress FireBox plugin <= 3.1.0-free - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS.This issue affects FireBox: from n/a through <= 3.1.0-free.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0019 Published 2025-12-09 No fix listed CWE-79